Art. 7 GDPR · Chapter II: Principles
Article 7 GDPR: Conditions for consent
Text as of 28 October 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the official text)
Where processing is based on consent, the controller must be able to show that consent was given, a request for consent must be clearly distinguishable and in plain language, and the data subject may withdraw consent at any time, as easily as it was given. When assessing whether consent is freely given, utmost account is taken of whether a contract is made conditional on consent to processing that is not necessary for that contract.
Official text
Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.
If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.
The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.
When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu
Text as of 28 October 2026.
This is reference material, not legal advice.
Related recitals
This list is under review.
Court of Justice judgments
- C-252/21, Meta Platforms Inc and Others v Bundeskartellamt
Judgment of 4 July 2023ECLI:EU:C:2023:537
A competition authority may find GDPR breaches when examining abuse of dominance, in cooperation with data protection authorities; collecting off-platform data that reveal sensitive traits is special-category processing; personalised advertising from such data cannot rest on contract necessity and only narrowly on legitimate interest; dominance does not bar valid consent but weighs on whether it is freely given.
- C-61/19, Orange Romania SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
Judgment of 11 November 2020ECLI:EU:C:2020:901
The controller must prove that consent was given by active behaviour after clear information; a contract with a pre-ticked box for storing ID copies does not show valid consent, nor does a form that makes refusal harder.
Related (earlier law or other instruments)
- C-673/17, Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. v Planet49 GmbH
Judgment of 1 October 2019ECLI:EU:C:2019:801
Instrument: GDPR together with the ePrivacy Directive (Art. 5(3))
A pre-ticked checkbox does not give valid consent to cookies, whether or not the data are personal data; users must be told how long cookies last and whether third parties can access them.
EDPB guidance
- Joint Guidelines (European Commission and EDPB) on the interplay between the Digital Markets Act and the GDPR
EDPB-COM DMA/GDPRDraft for consultationFirst published 9 October 2025
Joint text; consultation closed 4 December 2025; final not yet published.
- Opinion 08/2024 on valid consent in the context of consent or pay models implemented by large online platforms
EDPB Opinion 08/2024FinalFirst published 17 April 2024Final version 17 April 2024
Art. 64(2) opinion; date is EDPB publication date.
- Guidelines 03/2022 on deceptive design patterns in social media platform interfaces
EDPB 03/2022FinalFirst published 21 March 2022Final version 24 February 2023
Version 1 was titled 'dark patterns'.
- Guidelines 05/2020 on consent under Regulation 2016/679
EDPB 05/2020FinalFirst published 4 May 2020Final version 4 May 2020
Supersedes WP29 WP259 rev.01. Covers children's consent under Art. 8.
Fines
Amounts are shown in the currency in which the fine was imposed.
- CRITEO: EUR 40,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 15 June 2023Appeal status: unknown
Ad-tech company could not show that the people whose browsing data it processed had consented, gave incomplete information, mishandled access, withdrawal and erasure requests, and lacked a proper joint-controller arrangement with partners.
- TIM S.p.A.: EUR 27,802,946
Garante per la protezione dei dati personali, ItalyDecision of 15 January 2020Appeal status: unknown
Aggressive telemarketing: calls to people who had refused or were on internal block lists, marketing without valid consent, and weak control of call-centre partners.
Not fully confirmed: Amount, date and name read in the decision (register no. 7 of 15 January 2020). Articles listed are those the decision states for its main finding (section 3.1, which also cites Article 130 of the Italian Code); later sections discuss further provisions (e.g. Articles 12 and 21), so the list may be incomplete.